CVE-2022-28734 describes an out-of-bounds write vulnerability in GRUB2's HTTP code, affecting gnu grub2 and NetApp Active IQ Unified Manager. This flaw occurs when handling split HTTP headers, causing a NULL byte to be written past an internal buffer, potentially corrupting GRUB2's memory metadata. With a CVSS score of 7.0 (High), it can be exploited remotely with high attack complexity, leading to potential low confidentiality, low integrity, and high availability impacts. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.00, < 2.06-3CPE matchmatch criteria | cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.